GCVE-110-OSM-2026-6939

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY src/index.js (main: ./src/index.js) EXFIL - Network Request in src/common.js: "https.request(" OBFUSCATION - Dynamic Base64 Decoding in src/common.js: "Buffer.from(encodedMessage, "base64")" - String Array Obfuscation in src/browser.js: "[ '#0000CC', '#0000FF', '#0033CC', '#0033FF', '#0066CC', '#0066FF', '#0099CC', '..." - Strings Extracted from Deobfuscated Code in src/common.js ADDITIONAL FINDINGS - Dynamic Code Execution in src/common.js: "new Function("require", decodedCode)" - Brand New Package PAYLOAD FILES src/common.js INDICATORS (IOCs) - urls: https://webpack.js.org/api/loaders/, https://webpack.js.org/configuration/devtool/, https://webpack.js.org/configuration/resolve/, https://webpack.js.org/concepts/hot-module-replacement/, https://packagephobia.now.sh/badge?p=less-loader (+2 more) - domains: vision-media.ca, webpack.js.org, lesscss.org, packagephobia.now.sh, tootallnate.net (+1 more) - emails: tj@vision-media.ca, nathan@tootallnate.net - payloadFileHash: 16527ff1117b8744a52b939fd4b384361f9110305642d5892964aef53cf66a59